openfeed

defmodule OpenFeed.MixProject do
  use Mix.Project

  @version "0.1.0"
  @source_url "https://github.com/benkolera/ash-openfeed"

  # oidcc's Erlang source uses triple-quoted strings, which do not compile on
  # OTP 26 or earlier — and mix.exs has no way to declare an OTP requirement.
  # Checking here turns a baffling dependency compile error into a clear message.
  if String.to_integer(System.otp_release()) < 27 do
    Mix.raise("""
    openfeed requires OTP 27 or later, but this is OTP #{System.otp_release()}.

    The constraint comes from oidcc, whose Erlang source does not compile on
    OTP 26. Elixir 1.17 and later are supported, on OTP 27 or later.
    """)
  end

  def project do
    [
      app: :openfeed,
      version: @version,
      elixir: "~> 1.17",
      elixirc_paths: elixirc_paths(Mix.env()),
      start_permanent: Mix.env() == :prod,
      deps: deps(),
      description:
        "Client for OpenFeed (Australian CDR banking and energy data). " <>
          "Handles the FAPI 2.0 Security Profile — PAR, PKCE, DPoP — and key management.",
      package: package(),
      docs: docs(),
      name: "OpenFeed",
      source_url: @source_url
    ]
  end

  def application do
    [extra_applications: [:logger, :public_key]]
  end

  defp elixirc_paths(:test), do: ["lib", "test/support"]
  defp elixirc_paths(_), do: ["lib"]

  defp deps do
    [
      # 3.8.0 is the first release with pluggable HTTP adapters
      # (erlef/oidcc#528), which we need because the default httpc adapter
      # intermittently wedges against auth.openfeed.au.
      {:oidcc, "~> 3.8"},
      {:req, "~> 0.5"},
      {:jason, "~> 1.4"},
      # For monetary values. OpenFeed encodes money as ISO 20022 strings in
      # banking and as JSON numbers in energy, and neither should ever be
      # handled as a float — see OpenFeed.Amount. Matches ash's constraint so
      # the two always converge.
      {:decimal, "~> 2.0 or ~> 3.0"},
      # Req.Test needs Plug. Deliberately NOT using Bypass: it drags in
      # cowboy/cowlib/ranch purely for tests, and cowlib 2.19.0 (the latest
      # release) carries two unfixed advisories — EEF-CVE-2026-43966 and
      # EEF-CVE-2026-43969. Req.Test stubs in-process with no socket, so the
      # whole tree goes away. It also forces every HTTP entry point to accept
      # caller-supplied Req options, which is the testability seam we want.
      {:plug, "~> 1.0", only: :test},
      {:ex_doc, "~> 0.34", only: :dev, runtime: false}
    ]
  end

  defp package do
    [
      maintainers: ["Ben Kolera"],
      licenses: ["Apache-2.0"],
      links: %{
        "GitHub" => @source_url,
        "Changelog" => @source_url <> "/blob/main/openfeed/CHANGELOG.md",
        "OpenFeed API reference" => "https://openfeed.au/developers/api"
      },
      files: ~w(lib documentation mix.exs README.md CHANGELOG.md LICENSE .formatter.exs)
    ]
  end

  defp docs do
    [
      main: "readme",
      source_ref: "v#{@version}",
      extra_section: "GUIDES",
      extras: [
        {"README.md", title: "Home"},
        "documentation/tutorials/collecting-data.md",
        "documentation/topics/grant-management.md",
        "documentation/topics/cost-and-cadence.md",
        "CHANGELOG.md"
      ],
      groups_for_extras: [
        Tutorials: ~r"documentation/tutorials/",
        Topics: ~r"documentation/topics/"
      ],
      groups_for_modules: [
        Configuration: [OpenFeed.Config, OpenFeed.Scopes, OpenFeed.ProviderConfiguration],
        "Reading payloads": [OpenFeed.Amount, OpenFeed.Energy],
        "Key management": [
          OpenFeed.KeyStore,
          OpenFeed.KeyStore.File,
          OpenFeed.KeyStore.Env
        ],
        Authorization: [OpenFeed.Auth, OpenFeed.Tokens, OpenFeed.Dpop],
        "Sharing API": [OpenFeed.Sharing, OpenFeed.Client, OpenFeed.Error],
        Internals: [OpenFeed.ReqHttpAdapter]
      ]
    ]
  end
end